5) After all, I don't see why writing 1 regexp is a hard task. And it won't be really slower because of (4).A regexp is unreliable and slow. Lots of ssh blocking tools have had various security issues due to this.
That only depends on whether you know the format of that what you parse. Binary log with an unknown/unstable format may also be unreliable.
-- With best regards, Vitaliy Filippov